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1. Introduction 



The problem of counting the number of integral points of an elliptic curve over a 
finite field has captured the interest of both pure number theorists and cryptog- 
raphers. It is important in cryptography to know the number of integral points 
in order to evaluate the difficulty of solving the discrete logarithm problem in the 
group of points on an elliptic curve. 

The number of applications of the theory of elliptic curves to cryptography over 
the last decades is overwhelming. Among the most important applications are the 
ones in public key cryptography (see [9], [10], [14], [21]), primality testing (see [2], 
[4]) and the factoring of large integers (see [13], [16]). 

In this paper we shall investigate the problem of the representation of the number 
of integral points of an elliptic curve modulo a prime number p. Our first thought 
when dealing with this problem would be to consider an elliptic curve of the form 
= + ax ~\-h (mod p), with a, 6 G Z and p a prime number, and try to identify 
for which values a; = 0, 1, . . . , p — 1 the integer x^ + ax + h is a. square mod p. 
However, among the nonzero integers mod p half of them are squares. From the 
other half, we obtain two roots, namely y and —y. Therefore, we expect that the 
equation y^ ~ x^ + ax + h { mod p) will be satisfied for approximately p pairs {x,y). 
In other words, we expect the elliptic curve to have more or less p + 1 points, count- 
ing also the point at infinity. 

In 1930, H. Hasse (Math. Z. 31(1930), 565 - 582) proved the following very deep 
result (see [19] for a proof). 

Theorem 1.1. Let p he a prime number and E an elliptic curve over the finite 
field Fp. Then 

|#i?(Fp)-p-l|<2Vp. 

Moreover, a very interesting result is that whenever there exists an integer TV, such 
that 

|iV-p-l| <2v^, 

then there exists an elliptic curve mod p which has exactly N integral points (see 
also [21]). 

When the prime number p is considerably small, it is easy to calculate the number 
of integral points on an elliptic curve mod p, but for large prime numbers this 
becomes very difficult. An efficient algorithm for calculating the number of integral 
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points over finite fields was discovered in 1985 by R. Schoof (see [18]) and was later 
improved by N. D. Elkies and A. O. L. Atkin (scc[3]). 

There exist several formulae for the representation of the number of integral points 
of an elliptic curve mod p. One of the most commonly used is the following. 
The number of solutions of the congruence 

= + ax + h (mod p) 

where x, y G Mp = {0, 1, . . . , p — 1} and a, b G Z can be expressed in the form 
(see [15]) 

p-i p-i ^ p-i p-i 

= - ^ ^ ^2wimF{x,y)/p =p^ 1 ^ ^ ^27vimF{x,y)/p ^ 
^ x,y—Om—0 ^x,y=Om=l 

where F{x, y) = y^ — x^ — ax — b. 

Of course, if we are talking about elliptic curves and not just congruences, then 
since the point at infinity is the neutral element of the additive group of an elliptic 
curve, we have to add one to the previous formula obtaining 

p—1 p—1 



27rimF{x,y)/p 



P 

a:,y— Om=0 



It is a known fact (see [6], [11], [12]) that 

^2mmy'^/p _ \^ 1^1 gSTimy/p 



y=0 y=0 



= < 



f)v^, ifp=l(mod4) 
^ (f)^VP, ifp=3(mod4). 



where ^-^ denotes the Legendre symbol. 

There is no explicit analytical formula in order to calculate exponential sums which 
involve polynomials of third degree. Hence, we shall try to find a way to express 
the exponential sum using non-cxponcntial terms. 

2. Expressing Np in terms of rational functions 



By the definition of Bernoulli numbers we have 

^^+2-^ + ^7^" ' 

n>2 

where B„ denotes the nth Bernoulli number and < 27r, where z G C 

Hence, if we set z = —2mf{x)/p, where f{x) is a polynomial for which |/(a;)| < p, 

we obtain 

-27ri/(a^) _ -Kifjx) ^ ^ ^^^^m^l^ 

p (g-27rj/(x)/p _ p >2 



or 

—n „ fi M \ = 1 "I ^/ (^yri,x) , 

p _ g-27rz/(a;)/pj p v ' 

where 

G(n,x) = ^(-27rz)"^^. 
^ ^ n! ^ ^ 

Therefore, we get 

-1 



n>2 



or 



n>2 ^ 



which is equivalent to 

(2) e-27ri/(x)/p ^ _ 27ri/(a;) | p + mf{x) + ^ Gi(n, 

where 



1 



n>2 



However, it is a known fact that for every integer n > 0, 

Bn+l 



a-n) = - 



n+ 1 



Thus, we have 



n>2 n>l 



(n + 1)! 

n>l ^ ' ' 

y -(" + lV (_n)(-l)"+i(27rir+^^^^^ 
(n + 1)! ''^ ^ ^ pn 

n>l 
n>l 



But, 

C(-2n) = , 
for every natural number n. Hence, 

^Gi(n,a;) = ^ Gi(n,a;) 



n>2 n— odd 



C(-n),o_.^n+l/(a^)"+' 



■ odd 



n=l (mod 4) ti=3 (mod 4) 



Thus, we obtain 

n>2 n=l (mod 4) 

^ n! ^ ^ 

ri=3 (mod 4) 

Let 

^ n! ^ ^ p" 

Then we can write 

(3) E<^i("'^)= E ^Ka;)- E ^Ka;). 

n>2 n=l (mod 4) n=3 (mod 4) 

The following functional equation holds for every integer n 

C(n) - sin (^) r(l - n)C(l - n) . 

Also, for a positive integer n one has 

r(n + 1) = n! . 

Thus, 

sin ( ^) 

C(--) = -^;^(-!)C(n + l). 
Therefore, it is evident that 

2 sin ( — ) 

(4) 2)(n,x) = 

But, for n = 1 (mod 4) and n = 3 (mod 4) it follows that 

sin(^)=l and sm(J^^=-l, 

respectively. 

By using (4), identity (3) implies 

j2G,{n,x) = E rlc(n+i)/(^r^' 

n>2 n=l (mod 4) 

- E ^c(n+i)/(.:r^ 

n=3 (mod 4) 

or 

EGi(n,x) = -25(x), 

where 

(5) sw= E ^'""'if'^'"" . 

n= odd 

Thus, (2) becomes 

g-2W(^)/p = 1 _ 27rz/(x) (p + infix) - 25(x))"^ 
27ri/(a;) {p - 2S{x) - TTif{x)) 



= 1 - 



(p-2S{x)f + {'Kfix)f 



or 

(6) g-27ri/(c.)/p ^ g^^) ^ -^(^^ ^ 

where 

(T) = 1 , 2./(x)(2SW-rt 

(p-2S(a:)f + (p-2S{i))VW(i))^ 

However, the interesting case is when 

f{x) = + ax + b , 

where x, y G Mp and a, b G Z. 

In order to use the results obtained above, we must investigate the cases for which 
we have \f{x)\ < p, that is 

—p < + ax + b < p . 

But, unfortunately, there are no integers a, b, for which the above inequality holds 
true for every prime number p. Hence, we shall set 

- , , x^ + ax + b 

m = — 

instead. 

Consequently, by (6) we get 

(8) ^-2^i(x^+ax+b)/p ^ (g(^) ^ iR{x)f . 

In this case, it is obvious that there exist integers a and b (for example a = b = 1) 
for which the desired property is satisfied. Therefore, by (1) and (8) we obtain the 
following theorem. 

Theorem 2.1. For any elliptic curve y'^ = x^ + ax + b (mod p), for which the 
integers a and b are such that \f{x)\ < p, f{x) = {x^ + ax + b)/p^, the number of 
its integral points can be expressed in the form 

Np = l+p+-Y, Y,e^-^"^y''^Q{x)+iR{x)r^' , 

^ x,y=0 m=l 

where 

Qix) = 1 ^ , Rix) = - ^) 



(p - 2S{x)f + (nfix)) {p - 2S{x)f + (nf{x)) ' 

and 

S{x)= E 



C(n+l)/(x)"+i 



pn 

n— odd 

However, if we express the sum involved in the representation of Np presented in 
the above theorem, in a slightly different form and use the same technique, we can 
end up with terms of power m instead of mp"^ . In addition, the following method 
has the advantage of dealing with elliptic curves for which we do not necessarily 
have 

x'^ + ax + b 



P 

5 



<1, 



for all X GMp. 

Let f{x) = + ax + b and 



p-i 



-27rimf{x)/p 



x=0 



Then, if a, 6 > (i.e. f{x) is an increasing and positive valued function), we can 
express X in the form 

L p-l 
X = Q-'^-^i'mf(x)/p _|_ ^-2mmf{x)/p ^ 



x=0 



x=L+l 



where L is such that 



fix) 



P 



<1, 



for every a;, < a; < L. Hence, we can write 

L p-l 
x=0 a:=L+l 

In the second sum of the right hand side of the above relation, it always holds 



fix) 



P 



> 1 . 



Therefore, for the values of x for which L + l<x<p— 1, let 

fix) 



P 



= k{x,p) +r{x,p) , 



where k{x,p) e Z and r{x,p) G M, with < r{x,p) < 1. In the following, we shall 
denote k{x,p) and r{x,p) by k and r, respectively. 
Then, we have 

g— 27ri/(x)/p _ g-27ri(/c+r) _ 

But, wc always have \2nir\ < 27r. Thus, by the generating function of Bernoulli 
numbers 

z z . x-^ B„ 



1 2 



1 + E 



n>2 



n! 



for z = — 27rir, we obtain by exactly the same procedure we followed previously, 

that 

e-2-'- = Qi(r)+zi?i(r), 

where 

27rr (1 - 2VF(r)) 



27r2r2 

(9) Qi(r) = 1 2 

(1 - 2W{r))^ + (7rr)2 



i?i(r) = 



and 
(10) 

Hence, 



(1 - 2W{r))^ + (7rr)2 
W{r)= C(n + l)r-"+^ 



n=odd 



p-l 



X = J2iQix)+iRix))"'+ J2 iQiix)+iRiix))'' 

x=0 x=L+l 

and therefore we obtain the following theorem. 



Theorem 2.2. Let f{x) = + ax + b, where a, b G Z. For any elliptic curve 
y"^ = f{x) (mod p), such that a, b > 0, the number of its integral points can be 
expressed in the form 



p—1 p—1 / L p—1 

^m=Oj/=0 \x=0 x=L+l 



Arp = l + l|]|]e2W/W^(Q(^) + iij(^))™+ {Qi{x)+iRi{x)y 



where L is an integer such that \f{x)/p\ < 1, for every integer x, with < x < L. 
Similarly, if a < —2>{p— 1)^ and b <0, the number of integral points on the elliptic 
curve can be expressed in the form 



= 1 + - Y^^^'"""^!^ {y {QAx)^iR^{x)r + E {Q{^)'riR{x)r\ , 

P m=Oy=0 \x=0 x=L+l ) 

where L is an integer such that \f{x)/p\ < 1, for every integer x, with L + 1 < x < 
p—1. The functions S{x), Q{x), R{x), Qi{x), Ri{x) and W{r) are defined by (5), 
(7), (9) and (10), respectively. 

In the case where — 3(p — 1)^ < a < the function f{x) is neither increasing nor 
decreasing for the whole interval of a;. In that case, we would have to break the 
sum into more than two summands in order to apply the above technique. 
For the cases of a which we investigated, the only thing remaining is to identify the 
value of L for a given elliptic curve (mod p). But, this is always possible since it 
suffices to solve the equation x^ + ax + b — p = Q and from the solution, choose the 
appropriate value for L. 

For example, given the elliptic curve with equation y^ = cc^ + 5x + 37 and the 
prime number p = 1087, it follows that xq = 10 is the solution of the equation 
a;^ + 5a; + 37 - 1087 = and therefore we obtain L = 9. 



3. Computing the function ^(a;) 
It is well known (see [20]) that 

'k 



(11) ^^=in(r(l-t))-7t, 



fe>2 



for every t G K, such that |t| < 1, where 7 denotes the Eulcr-Maschcroni constant. 
Let f{x) be a polynomial function, such that |/(a;)| < p, where < x < l.Then, 
by (11) we can write 



np " ^-^ np " ^—^ up " 

n>2 n= even n= odd 

n>3 

n+l, 



^ 1 ^ /(x)"+iC(n + l) 
P (n+l)p" 



/(x)"C(n) 



P (n+l)p" np'^ 

n= odd ^ ' n= odd 

n>3 
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Because of the uniform convergence of the above series, differentiating we get 

1 ^ rix)f{xrC{n + l) ^ f'ix)f{xr-\{n) _ d fix)\\ 

n— odd n— odd 

n>3 

which is equivalent to 
where 

Six) = E ^^^^'"f -^^^ and Six) = ^ ^^^^^^^ 

n— odd n— odd 

n>3 

However, for any t > 0, it can be proved that (see [5]) 

dln(r(t)) _ _ 1+^/^1 1 



n>l ^ 



Hence, 



Thus, since we are investigating the case when f'{x) is either strictly positive or 
strictly negative (i.e. nonzero), we have 

(12) Six) + pfix)Six) = fix) (^j-- -(l- ^) A, ix) 



P - fix) 
where 

Aiix)^Y. ^ 



„>i 71 ( 1 - ^ + n 



But, by (11) it is evident that for every i e R, such that |t| < 1, we have 

)\ 

k>2 ^ 

Hence, if we substitute again t by fix)/p, where |/(a;)| < p and then calculate the 
derivative of both sides, we obtain 



fix) 



p " ^-^ n " I p dx 

n= ovon ' n= odd ' 

\ Tl>3 



/(a:)p p /'(.t) dx 

Equivalently, 

Six) - pfix)Six) = -ffix) + fix) f -7 - -77^— + E ( - 



By /'(x) wo denote the derivative df{x)/dx. 



or 

(13) S{x) - pfix)S{x) = fix) [-J^^ + (l + ^) ^i(^)) , 
where 

Therefore, by adding (12) and (13) by parts, we obtain the following Proposition. 
Proposition 3.1. Let 

n= odd 

where f{x) is such that \f{x)\ <p. Then, it holds 

(14) . /(., [JEM. _ (i _ ZM) ^,,,) + (, + M) B.,.) 

where 



But, it is easy to sec that both series Ai{x) and Bi(x) converge to a real num- 
ber. Therefore, (14) gives an explicit formula for the representation of S{x), when 
|/(a;)| < p. In order to find an upper and a lower bound for S{x), we shall use the 
following lemma. 



Lemma 3.2. Let a, (3 be real numbers, such that 13 > a > 0. Then, 

-dx . 



1 _ 2,/3 



V 1 _ 1 r x" - 

^^{k + aj{kTW) ~ Jo ^ 



Proof. Recall the geometric series 

which converges uniformly in the interval {—6, 6), where < ^ < 1. Thus, 
where k = j + 1. Hence, 

k + a k + l3 



J = lim / ^- —dx = lim ( - 

6^0+ Jo 1-X e^0+ f-^ V 



fe>l 

and thus 

J= lim E(l-e)'^(fc.«./5), 



where 

(1-e)" (l-e)/^ 



k + a k + l3 
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However, 

k + a k + p 

Therefore, 

where 5i and ^2 are real constants. But, for < e < 1 we have 

1 



1 + e 

and hence 



= l- e + e^T--->l-e 



(l-e)^ = ^_ = I 



1 

< 



Thus, 



(l-e)'=e(fc,a,^) < 



{k + a){k + p) {k + a){k + + ke) ' 
Since 

0<{l-ef^{k,a,(3) < ^, 

for c > 0, it follows that the scries J converges uniformly and absolutely for every 
e, such that < e < 1. Therefore, we can interchange the sum with the limit for 
e^0+. □ 



The above lemma yields that 



1 f'^ X- x^+i 



dx , 



4:^ n(n + A) A Jo I- x 

n>l 

for every A, such that A > 0. Hence, for A = 1 ± f{x)/p , we obtain 



and evidently 



^ = C{2) < C{X) < C{0) = ^ 



5 TT^ 



Therefore, from (10) and the above relation, we obtain 



m , + ^ < 25(a;) < fix) 



p2-/(a;)2 QpJ \p-2 _ f(^j.-^2 ^pj ■ 
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4. Computing the function W{r) in terms of r 



Recall that 

n— odd 

where r = r(x,p). To compute M^(r) in terms of r, we shall follow a similar 
procedure to that of the previous section. 

Assume that f{x)/p ^ Z. Then, r ^ and also r is locally differentiable. Then, if 
we set i = r in (11), we get 

— = In r(l — r) — 7r . 

n>2 ^ 

Differentiating with respect to a;, we have 



— d 



- y r"C(n) = lnr(l - r) - 7/ 
r ^ dx 

n>2 



which is equivalent to 

dx 



=cvcn n=odd 



Hence, 

(15) W{r) + W{r) = r I + (r - 1) ^ 



1 — r n(n + 1 — r) / ' 



where 

Wir)= J2 ^"cw 

Ti— odd 

Similarly, by setting t = — r in (11) it follows that 



(16) W{r) - W{r) = r 



+ n{n + 1 + r) | ' 

n>l / 



By (15) and (16), we obtain the following Proposition 
Proposition 4.1. Let 

W{r)^ J2 C(" + l)r"+\ 

n—odd 

where r — r{x,p) represents the fractional part of the function f[x)/p. Then, it 
holds 

(17) 2W{r) = r + " l)A2{r) + (r + l)B2(r)^ , 

where 

^- — ^ rj ( rj 4- 1 — r\ ^ — ^ 



-' n(n + 1 — r) n(n + 1 + r) 

>i ^ ^ n>l ^ ' 



^ By r' we denote the derivative dr(x,p) / dx. 
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As expected, by (17) we see that the function W{r) converges to a real number. 
The above result holds true only when f{x)/p is not an integer and thus r is 
differentiable. But, if this is not the case, it is clear that r = and therefore 
W{r) = 0. However, according to Lagrange's Theorem for polynomials (see [17]) 
we know that for any polynomial of the form 

h{x) — a„a;" + a„_ia;"^"'" + • • • + aix + qq , 

where oq, ai, . . . , a,i G Z, the polynomial congruence 

h{x) = (mod p) , 

where p is a prime number, such that an ^ (mod p), has at most n solutions. 
Therefore, in our case, it is evident that the polynomial congruence 

f{x) = (mod p) , 

where f{x) = x^ + ax + b, has at most 3 solutions. In other words, there exist at 
most 3 values of a; G Mp, such that r = 0. 



5. Some remarks concerning the fractional part of f{x)/p 



In the previous section, we have computed the function W{r) in terms of the frac- 
tional part r of the function f{x) /p. Generally, we could say that the fractional part 
of an arbitrary function has a relatively random behavior. However, the fractional 
part r has a more predictable behavior. In this section, we will present some basic 
properties of the function r. 

It is evident that the number of factortJl of n I which are divisible by p, is equal 
to [n/pj. Note that by [u\ we denote the greatest integer not exceeding the real 
number u. However, for any integer n we know that 

1 £^ , r 1 , if n = (mod p) 

P [ , otherwise . 

Hence, it is clear that 

n p—1 



^ ^ ^ ^ ^ 27Timk/p 
P 

^ k=l m=0 



n 
.P 

Therefore, if f{x) is any function of the form 

(18) f{x) = a„a;" + Un-ix"^^ H h aix + qq , 

where ao, ai, . . . , a„ G Z and x G Mj,, such that f{x) > 0, it follows that 



p 



1 



fix) p-1 



_ g2irimfe/p 
P k=l m=0 



when f{x) > 1, and obviously is equal to zero when f{x) — 0. Thus, we obtain the 
following Proposition. 



^ By the term factors of n ! we refer to the integers 1, 2, . . . , n — 1, n. 
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Proposition 5.1. For f{x) defined by (18), it holds 



Let 
that is 

Then, we have 



lU.p) 



p 

fix) p~l 



k/p 



P k=l m=0 



where (/ — = f{x) — 1. Hence, we can distinguish two cases. 
Case 1. If f{x) ^ (mod p), then it follows that 

I{I.p)^I{I -l.p). 

Therefore 

f{x)-i\ n{x)\ 1 



p ) i p ) p 

Case 2. If f{x) = (mod p), then evidently f{x) — 1^0 (mod p) and thus, we 
obtain 



and by Case 1, we get 
Hence 
Therefore, 

f{x)^2 \ _ \f{x)\ ^ / 2\ ^ 2 
p ] \ p ] \ p) P 
since in this case it holds {f{x)/p} — 0. Hence, the following Proposition holds 
true. 

Proposition 5.2. If f{x) ^ (modp), then 

'f{x)\ (.fix)-l\ , 1 



/(/,P) = H 


-Hf 


-i,p) 


I{f-l,p) = 


Hf 


-2,p). 


nf,p)^i + 


i{f- 


-2,p). 




H 









p 



If f{x) = (mod p), then 



P ) P 



^ By {«} we denote the fractional part of the real number u. More specifically, we define 
{u} = u — [itj. Thus, {it} > for every real number u. 
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Corollary 5.3. There does not exist a polynomial of the form 

g{x) = 6„a;" + 6„_ia;""^ H + 6ix + 5o , 

with bo, bi, . . . , bn (z and x G Mp, such that 

where f{x) is defined by (18) with f{x) +2^0 (mod p). 

Proof. Let us assume that there exists such a polynomial g(x), for which 

^1 = brJixT + 6„-i/(a;)"-i + • • • + b^f{x) + 6o • 
P J 

There exists a positive integer k, with < ^ < P ~ 1, such that 

f{x) — fc = (mod p). 

Thus, we have 

' f{x) \ ^ k 
p ] p' 
According to Proposition [221 we obtain 

\ f{x)-k-2 \ 2 
I P J P' 

Therefore, we must have 

(19) g (fix)) = hnfixr + b,,.if{xr-^ + ■■■ + bifix) +bo = - 

P 

and 



P 



6„ (fix) - fc - 2)" + 6„_i (fix) - fc - 2)"-^ + • • • + 6i (/(:e) - fc-2) + 6o = l- - 

P 

Thus, by the above relation we get 

" 2 

(20) g (fix)) + Xf{x){k + 2) + Y.{-lY{k + 2Yb, = 1 

9=1 

for some integer A. Hence, by (19) and (20), we obtain 

" 2 fc 

(21) A/(a;)(fc + 2) + ^^(-l)^^ + 2)^5, = 1 , 

which is a contradiction, since the left hand side of (21) is always an integer, whereas 
the right hand side is never an integer. □ 

Since the representation of the fractional part that we have presented in Proposition 
15.11 involves exponential sums of the exact same form as the ones involved in the 
representation of Np in (1), it is apparent that the explicit calculation of {f{x)/p} 
is equally hard. For this reason, we shall limit ourselves to finding a lower bound 
for this fractional part. 



Proposition 5.4. For f{x) defined by (18), with f{x) > 1, it holds 

mm 

"1=0 ■■' m=[p/2J+l 
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{ p } P P r^^n ^ P 



^ /(^) 



1 — m/p 



Proof. It is a well-known fact that for any real number q, it holds 

B2 



E 



<min( i^,i?2-i?i ) , 



where Bi, B2 are integers with Bi < B2 and [q] — min^gz — Thus, we have 



-, /(^) P-1 -, P-1 



k=l m=0 



m— 



p-1 



1 

< - > mm . 

^ m=o ^ ^ ' 



1 



— — v\ 

p 



where [m/p] ~ min^g^ 
Since < m/p < 1, it is evident that for the values of m for which < m < [p/2j, 
we have v ~ and thus [m/p] = m/p. Similarly, for m such that [p/2j + 1 < to < 
p — 1 we get V — I and [m/p] = 1 — m/p. Therefore, we obtain 



fix) p-1 



„ E E 

^ fc=l m=0 



1 /I \ 

< - V min - — — 

1 Lp/2J , ^ p-1 



1 



1 — m/p 



m=0 ^ m=Lp/2j+l 

From the above inequality and Proposition 15 . 1 1 the desired result follows. 



□ 



By using the above result we can calculate a lower bound for the function W{r) of 
the previous section. 



6. An interesting observation 



In general, we have 



p-1 



E' 



^2-jriax/p 



p , if a = (mod p) 
( , otherwise . 
Hence, if we set a = 1, it is evident that 



p-1 

E' 



^■Kix Ip 



0. 



Moreover, the inequality [x[ < p holds true for every x £ Mp. Therefore, by (6), it 
follows that 

p—1 p—1 
^Q(a;)+j^i?(x) =0 

x=0 x=0 



and thus 



where 



p-1 



p-1 



Q{x) = and ^ R{x) = , 

x=0 

Q{x) = 1 



x=0 



{p-2S{x)f + {T:xf 
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R{x) 



AttxS{x) — 2p-Kx 



[p - 2S(x)f + i^x) 



2 ' 



and 



X 



.n+l 



C(n + 1) 



S{x) 



E 



n 



n— odd 



Hence, it follows that for every prime number p (actually the following result holds 
true even if p is not a prime number), we have 
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